9f361dfb2a33d6268b59b08e13895d5120bc9c7d003a418522d36490c7983e26

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6735e47b66f274ab315b351c672dccf0_JaffaCakes118.html
Size

37KB
MD5

6735e47b66f274ab315b351c672dccf0
SHA1

50a747f2a00b821637e70222b16e732681b3fa24
SHA256

9f361dfb2a33d6268b59b08e13895d5120bc9c7d003a418522d36490c7983e26
SHA512

ba91be5e97f478f5dc9a1ef7835927a1f7aa026847ff13515d4dd125aa13e2fa32182767d88ce4825e9c680833177f067cb3e475fc5d07ed89d49126c08ed41a
SSDEEP

768:fd7KaZZNzq+8CQJYD17BmxXyj1k3Yn/OA3qHMm/U:fdZtq+8C51791/OrHMn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19522B81-183A-11EF-A38F-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422544197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2176	2408	iexplore.exe	28
PID 2408 wrote to memory of 2176	2408	iexplore.exe	28
PID 2408 wrote to memory of 2176	2408	iexplore.exe	28
PID 2408 wrote to memory of 2176	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6735e47b66f274ab315b351c672dccf0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18eeb7206f8b9c9640717a247888ad34

SHA1
8cae709e10515d19844b76701da7e7adddb9fc0e

SHA256
7016b7dd15cd26c2118291c55eece5b75ddd0c79f9070528cc16717b7e527429

SHA512
dfbd6d5977df97d6ac54ec36c8ba0e2342cc4aacb2987f0bc15b5b9da0816f9e334159fcf35637742dfbba64bdc4a8f898a354b93356b6bcb322675434b8a09c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43853a671e3626daa6807b7e25b50e83

SHA1
e57aad478f74bf360588814f8cd651949b8797fb

SHA256
5a035fe6e67973d6dade8dbf5083b3fd7704624d1b07d0784a385409ffae0a42

SHA512
dd429a136143454b966e4aaec8af8d545dacd79159ff8508f4481fd4452d3b25372f16e2465e7e08c50d3e0e7c0ecc50395c3db46d746b7ff565fd5764398f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43ee7dfc81579162b98d3087a2f94d8

SHA1
4627b566546e9d97475d81a79dc11e1a905a25c7

SHA256
167154abc896b3caffe443fb5d7cc7139fd61b7da91bc14953501472ae0785d3

SHA512
758743e6c74ad5b4fce89e928c66dabf28ab0cee30ab2fe61c4a68cdb1faa6d6ceffb230b64be257f18613ac6217c534c803356585b5cf473030365145151cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e98841b94aa9cc6b5e711dabff52023

SHA1
8309189815766ae65f1d28867d6d756d8cbc3fa0

SHA256
8400e1bad3b020e2eb65486640461133348709cce65acb164e08cacac98cbabe

SHA512
8cba45eb45e0c00cbe6c20c772dcc62f3ae69db66b456f90c1f5c9be8113ff53d0046b52a41287b14df76565e8075eb70b3337f599e128b22147015f91fb946a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
891ea6aa71ce77526ae2884cfc2936c9

SHA1
7921fea817029dbf87840205a4909321cd6e52df

SHA256
1d6ae1f3673ebb0a88e12ebb87e807d6eb464c75547520a96f6f19e273a11b98

SHA512
48779be0feeb53910b64522eb7907539bc9e1efa9ba54a66cf725bed1c57e84519b275131de3a7c3c5fd878c426db94a7d4e0d65cd0002a011ebefc920dd07c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
114e32feb0b7e1663918191075a9ba79

SHA1
a6d3196392aa97bde2c9d42aa7fbe8a96c4fd68f

SHA256
b698b2eaf46239a37b88975a9efe99ca64fdbfe85bea968318d2bfcb92d39242

SHA512
3adf2d3b0fbe2438154bd56939019cbc16451a7d8d9b611de72534cd9820847e98d3a82f175b203e3d19d72530e5d35b8839ce4d05f3144767f5541290b7bcfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c4a0d5e6700a2d6f9194ef11c62586

SHA1
102ce2c7fdf29895c0d2711c9f7e6ab7c5a75f5f

SHA256
138b9b215a41edbf7648652089bac0e571a120c6e8f883b203353c474aefbaf6

SHA512
cad88089e1383b647b676a0eb83241fa5058adcf395fba2283367cc0dc412952b8538660dab89ce7e60527f1d1e2befaa1258efe6dee9ad994d984dd9702963c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f509febcc2a34ef6d0ca4dd4dc056c03

SHA1
5f63732aa6a936fe3b59bc9b31762168f5a10eb3

SHA256
5d3ccb28e3659febc48b6f7848e433d6e751c81d3c7aeb14e790b049ab92a8cf

SHA512
272030df888b6cc5c3b381f680804cbc3b31e76d6452975b339b08aba6367bf6a808768a3ab8b939909b1e1f68404e09bb8c80320b4bb3018280238052d050b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab203D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab211C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2140.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit